I've been reading up on non-persistent XSS and all of the examples I have found use the situation where a webpage takes something from the url/query string and places it on the page.

Is there any way to execute a non-persistent XSS attack without using the URL or query string?


Any time an application is building HTML from attacker controlled input it becomes a vector for XSS. For instance HTML5/JS applications on the Tizen and WebOS platforms can be subject to XSS via any number of vectors including Bluetooth, e-mail, Malicious NFC tags, and just about anything else you could imagine. Because JavaScript is building the HTML this falls under the bigger category of DOM Based XSS.

As a participant in the Google Bug Bounty Program I found XSS in Google Music by uploading an mp3 file with JavaScript in the ID3 tags. The application was displaying the Album name and Band name on the page, and that was enough.

  • 3
    Heh, that's smart. I wonder how many other sites have persistent XSS from file metadata...
    – Polynomial
    Dec 4 '12 at 7:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.